In a computing services environment, users gain access to services through networked computing entities, or components, interconnected by segments of the network. A component is a computing entity, such as a server, that is invoked to provide the service, and may interconnect with other servers for providing the service. The interconnection of components and segments associated with a service is often tracked by logging or “sniffing” transmissions (packets) sent between components (nodes) of the network. Flow data, including statistics about the data sent over the segments between the nodes, is often gathered as a barometer of network health. Tracking of metrics such as traffic volume (bytes), TCP retransmissions (RTX), network round trip time (RTT) and TCP resets often pinpoint problems and anomalies with specific segments and components.